I’m testing Chef 12 and ACL’s, but I can’t find a way to change my “Global
Permissions: cookbooks”

Today, to “cookbook show” my cookbooks, the user MUST be in at least,
“admin, clients or users” group.

But I would like to create a new group with minimium privilege such
permission in only one cookbook. To do so, I must remove the user from
"users" group, but sounds like I’m stuck on Global Permission:

Your instincts about what to do were correct; unfortunately this
seems like a bit of an edge case. It appears that listing the versions
of a named cookbook requires READ permission on the cookbooks
container and not just the named cookbook itself.

The container (called “Global Permissions” in parts of the UI)
typically controls what you can do across sets of objects (e.g. READ
on the nodes container allows you to list all nodes) and the
permissions that new objects have by default (e.g. if you have READ on
the clients container, you get READ on any newly created clients).

My guess is that this knife command will work for you:

knife cookbook show support CURRENT_VERSION -c knife-teste.rb

where CURRENT_VERSION is a version of support that is already
uploaded. That gets around the API call ("/cookbooks/support") that
requires READ on the container. Unfortunately, I don’t know of a way
to upload cookbooks that avoid a call to an endpoint requiring
container permission.

You can give your group READ permission on the cookbook container:

knife acl show containers cookbooks read group read-only

but this will have the unfortunate side effect of also giving them
READ permission on any cookbook created after you make this change
(existing cookbooks and new versions of existing cookbooks won’t be
affected).

I’m testing Chef 12 and ACL’s, but I can’t find a way to change my “Global
Permissions: cookbooks”

Today, to “cookbook show” my cookbooks, the user MUST be in at least,
“admin, clients or users” group.

But I would like to create a new group with minimium privilege such
permission in only one cookbook. To do so, I must remove the user from
"users" group, but sounds like I’m stuck on Global Permission: